Troj/FakeAv-AAL is a Trojan for the Windows platform.
Troj/FakeAv-AAL downloads additional components to the following locations:
<PROGRAM FILES>\Common Files\InternetAntivirusPro.exe (Troj/FakeAv-AAL)
<PROGRAM FILES>\Common Files\file.exe (Troj/Sniffer-R)
Troj/FakeAv-AAL also copies itself to
<PROFILE>\Application Data\Microsoft\Windows\winlogon.exe
and sets the following registry entry to run on startup
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows logon process
<PROFILE>\Application Data\Microsoft\Windows\winlogon.exe